January(137) February(207) March(430) April(317) May(278) June(237) July(216) August(316) September(186) October(24) November(114) December(126)
DATE | NAME | INFO | CATEGORY | SUBCATE |
28.9.24 | Wallet Scam: A Case Study in Crypto Drainer Tactics | Check Point Research (CPR) uncovered a malicious app on Google Play designed to steal cryptocurrency marking the first time a drainer has targeted mobile device users exclusively. The app used a set of evasion techniques to avoid detection and remained available for nearly five months before being removed. | HACKING | CRYPTOCURRENCY |
28.9.24 | CVE-2024-8190 - Ivanti Cloud Service Appliance Command Injection vulnerability | CVE-2024-8190 is a high severity (CVSS score 7.2) OS Command Injection vulnerability affecting Ivanti Cloud Services Appliance (CSA) versions 4.6 Patch 518 or older. If successfully exploited the flaw might allow a remote authenticated attacker for arbitrary code execution. | ALERTS | VULNEREBILITY |
28.9.24 | Vidar malware spreads via PEC Mail and Telegram profiles | CERT-AGID has identified a new campaign distributing Vidar through PEC mailboxes. The attackers are still leveraging Steam community profiles, but a significant new tactic involves exploiting Telegram profiles. In particular, the bios of these profiles are being used to reveal the IP addresses of their command and control (C2) servers. | ALERTS | VIRUS |
28.9.24 | Louse APT Group launches malware campaign targeting Chinese entities | The Louse APT group (also known as Patchwork and Dropping Elephant) has reportedly launched a malware campaign targeting Chinese entities. The attack vector involves a malicious LNK file, likely originating from a phishing email. This file executes a PowerShell script that downloads a decoy PDF and a malicious DLL, which is loaded using DLL sideloading techniques. | ALERTS | APT |
28.9.24 | CVE-2024-46908 | Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative | VULNEREBILITY | CVE |
28.9.24 | CVE-2024-46907 | Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative | VULNEREBILITY | CVE |
28.9.24 | CVE-2024-46906 | Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative | VULNEREBILITY | CVE |
28.9.24 | CVE-2024-46905 | Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative | VULNEREBILITY | CVE |
28.9.24 | CVE-2024-46909 | Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative | VULNEREBILITY | CVE |
28.9.24 | CVE-2024-8785 | Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative | VULNEREBILITY | CVE |
27.9.24 | Embargo | Embargo Ransomware Group Strikes DME Delivers in Cyber Attack | GROUP | RANSOMWARE |
27.9.24 | CVE-2024-47176 | cups-browsed <= 2.0.1 binds on UDP INADDR_ANY:631 trusting any packet from any source to trigger a Get-Printer-Attributes IPP request to an attacker-controlled URL | VULNEREBILITY | CVE |
27.9.24 | CVE-2024-47076 | libcupsfilters <= 2.1b1 cfGetPrinterAttributes5 does not validate or sanitize the IPP attributes returned from an IPP server, providing attacker-controlled data to the rest of the CUPS system | VULNEREBILITY | CVE |
27.9.24 | CVE-2024-47175 | libppd <= 2.1b1 ppdCreatePPDFromIPP2 does not validate or sanitize the IPP attributes when writing them to a temporary PPD file, allowing the injection of attacker-controlled data in the resulting PPD | VULNEREBILITY | CVE |
27.9.24 | CVE-2024-47177 | cups-filters <= 2.0.1 foomatic-rip allows arbitrary command execution via the FoomaticRIPCommandLine PPD parameter | VULNEREBILITY | CVE |
27.9.24 | DragonForce | Inside the Dragon: DragonForce Ransomware Group | GROUP | RANSOMWARE |
27.9.24 | DCRat | DCRat Targets Users with HTML Smuggling | MALWARE | RAT |
27.9.24 | CVE-2024-0132 | NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. | VULNEREBILITY | CVE |
27.9.24 | Hacking Kia | Hacking Kia: Remotely Controlling Cars With Just a License Plate | HACKING | CAR |
27.9.24 | FPSpy | Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy | MALWARE | BACKDOOR |
27.9.24 | KLogEXE | Unraveling Sparkling Pisces’s Tool Set: KLogEXE and FPSpy | MALWARE | KEYLOGGER |
27.9.24 | SilentSelfie | SilentSelfie: Uncovering a major watering hole campaign against Kurdish websites | CAMPAIGN | CAMPAIGN |
27.9.24 | Malspam campaign targeting transportation industry | Researchers have recently disclosed a malspam campaign targeting organizations in the transportation industry. The attack originates from compromised mail accounts and utilizes files with a .URL extension that is either attached to or linked within spam messages, if these URL files are opened the victims machine initiates an external SMB connection to download and run a remote malicious executable. | ALERTS | CAMPAIGN |
27.9.24 | SloppyLemming: Phishing campaigns targeting South and East Asia organizations | Reports indicate that a threat actor known as SloppyLemming has been actively targeting organizations in South and East Asia, particularly in Pakistan and Bangladesh. This actor employs open-source adversary emulation frameworks such as Cobalt Strike and Havoc. | ALERTS | CAMPAIGN |
27.9.24 | New DragonForce ransomware variant targets Global Industries with LockBit and Conti modifications | New variants of DragonForce ransomware, featuring modified versions of LockBit and Conti, have been observed targeting the manufacturing, real estate, and transportation industries worldwide. DragonForce operates a Ransomware-as-a-Service affiliate program, offering various attack management tools. The group employs the SystemBC backdoor for persistence, along with Mimikatz and Cobalt Strike for credential harvesting and lateral movement. | ALERTS | RANSOM |
27.9.24 | Twelve attack group aims to destroy | Established in 2023 in response to the Russian-Ukrainian conflict, the attack group known as Twelve has been observed targeting Russian government organizations. The group's tactics include file encryption via ransomware, file/system deletion via wipers, and exfiltration of sensitive data among others. Based on the analysis provided in a recently published report, the goal of the group is focused on destruction rather than financial gain. | ALERTS | HACKING |
27.9.24 | New KLogExe and FPSpy | New keylogger malware KLogExe and backdoor variant FPSpy have been used by Sparkling Pisces (aka Kimsuky, THALLIUM, Velvet Chollima) threat group. This APT group is known for its sophisticated cyber-espionage operations and advanced spear phishing attacks. Sparkling Pisces lure victims into downloading and executing malicious payloads. This includes the use of new and undocumented malware. | ALERTS | VIRUS |
26.9.24 | BlackJack | BlackJack is a hacktivist group that emerged at the end of 2023, targeting companies based in Russia. In their Telegram channel, the group states that it aims to find vulnerabilities in the networks of Russian organizations and government institutions. | GROUP | Hacktivist |
26.9.24 | SloppyLemming | Unraveling SloppyLemming’s Operations Across South Asia | CAMPAIGN | Crypto |
26.9.24 | Salt Typhoon | China's 'Salt Typhoon' Cooks Up Cyberattacks on US ISPs | CAMPAIGN | ISP |
25.9.24 | Taliban Stealer | Cyfirma researchers have discovered a website promoting a tool called 'Taliban Stealer'. Once executed, this stealer prompts the user to select what data to collect from the machine, such as passwords, cookies, or cryptocurrency wallets. | MALWARE | Stealer |
25.9.24 | Rage Stealer | A Comprehensive Analysis of Angry Stealer : Rage Stealer in a New Disguise | MALWARE | Stealer |
25.9.24 | X-FILES Stealer | X-FILES Stealer: Advanced malware with sophisticated features and ongoing enhancements | MALWARE | Stealer |
25.9.24 | QWERTY Stealer | QWERTY is a newly discovered infostealer variant observed being hosted on a Linux-based virtual private server located in Germany with limited service exposure. | MALWARE | Stealer |
25.9.24 | et Another Silly Stealer (YASS) | There's Something About CryptBot: Yet Another Silly Stealer (YASS) | MALWARE | Stealer |
25.9.24 | POWERSHELL KEYLOGGER | At CYFIRMA, we are dedicated to delivering timely insights into emerging threats and malicious tactics that pose risks to both organizations and individuals. This report offers an analysis of a newly identified keylogger that operates via a PowerShell script. | MALWARE | Keylogger |
25.9.24 | Poseidon | Poseidon Stealer Uses Sora AI Lure to Infect macOS | MALWARE | Stealer |
25.9.24 | Luxy | Luxy: A Stealer and a Ransomware in one | MALWARE | Stealer |
25.9.24 | Gomorrah | Gomorrah Stealer v5.1: An In-Depth Analysis of a .NET-Based Malware | MALWARE | Stealer |
25.9.24 | Emansrepo | In August 2024, FortiGuard Labs observed a python infostealer we call Emansrepo that is distributed via emails that include fake purchase orders and invoices. | MALWARE | Stealer |
25.9.24 | BLX (aka XLABB) | BLX Stealer known also as XLABB Stealer is a malware variant initially discovered back last year. New activity attributed to this infostealer has been observed in the wild. | MALWARE | Stealer |
25.9.24 | RomCom RAT | Security Brief: Actor Uses Compromised Accounts, Customized Social Engineering to Target Transport and Logistics Firms with Malware | MALWARE | RAT |
25.9.24 | The messages contained URLs which directed users through various dialogue boxes leading them to copy, paste, and run a Base64 encoded PowerShell script contained within the HTML, a technique called "ClickFix." The scripts led to an MSI file used to load DanaBot. | HACKING | HTML | |
25.9.24 | Foxtrot Ransomware - a new MedusaLocker variant | Foxtrot is a latest ransomware variant from the MedusaLocker family. The malware encrypts user files and appends .foxtrot70 to them. The ransom note is dropped in form of a .html file called "How_to_back_files.html". Foxtrot comes with functionality to delete the volume shadow copies and Windows Backup on the infected machines. | ALERTS | RANSOM |
25.9.24 | PDiddySploit Trojan Malware | A recent research study has revealed that the scandal surrounding Sean 'Diddy' Combs, also known as P. Diddy, has been exploited. Attackers often capitalize on public interest in high-profile scandals to spread malware, taking advantage of the topic to trick unsuspecting users into downloading malicious files. | ALERTS | VIRUS |
25.9.24 | Turkey and Bulgaria Targeted in Remcos RAT Attacks | Symantec has recently observed two ongoing Remcos RAT campaigns from the same actor, targeting companies in Bulgaria and Turkey. In the Bulgarian campaign, they are using a classic invoice scheme (email subject: Плащане на фактура) to lure users, while in the Turkish campaign, they are using SWIFT transfer social engineering (email subject: Gelen Swift Mesaj). | ALERTS | VIRUS |
25.9.24 | Nanocore RAT Spreads Through Fake XLS Invoice | Nanocore RAT was highly prevalent many years ago and since has drastically dwindled but some groups and individuals continue to leverage this remote access trojan in their campaigns. One recent example being a fake invoice malspam campaign in which the authors have attached a malicious XLS (invoice.xls) that when executed will grab the Nanocore binary from a Discord server. | ALERTS | VIRUS |
25.9.24 | SnipBot - a new variant of the RomCom malware | Researchers from Palo Alto reported on a new variant of the RomCom malware dubbed SnipBot. The malware allows the attackers to execute command-line commands on the infected endpoints as well as to download additional arbitrary modules. | ALERTS | VIRUS |
25.9.24 | New Octo2 mobile malware variant observed in the wild | New variant of the Octo Android malware dubbed Octo2 has been identified in the wild. The malware has been spread via malicious campaigns targeting mobile users from European countries. | ALERTS | VIRUS |
25.9.24 | CVE-2024-0153 | Arm is aware of a number of security vulnerabilities in the Arm Mali GPU Kernel driver and their details are listed below. | VULNEREBILITY | CVE |
25.9.24 | Splinter | Discovering Splinter: A First Look at a New Post-Exploitation Red Team Tool | MALWARE | Tool Exploit |
25.9.24 | SpAIware | Spyware Injection Into Your ChatGPT's Long-Term Memory (SpAIware) | MALWARE | Spyware AI |
24.9.24 | Polyfill.io Supply Chain Attack | Over 100,000+ sites have been impacted by a supply chain attack involving the Polyfill.io service. Polyfill is a popular tool used for enhancing browser capabilities by hundreds of thousands of sites to ensure that all website visitors can use the same codebase for unsupported functionality. | ATTACK | ATTACK |
24.9.24 | Brain Cipher Ransomware Attack | A significant ransomware attack has struck Pusat Data Nasional (PDN), one of Indonesia’s government-owned national data centers. This incident involved threat actors encrypting government data, which disrupted digital services for immigration, airport checks, and several public services | ATTACK | ATTACK |
24.9.24 | SnakeKeylogger Attack | Threat actors are continuously preying on end users to unknowingly install a trojan stealer known as SnakeKeylogger or KrakenKeylogger. This trojan was developed using .NET and targets Windows users. | ATTACK | ATTACK |
24.9.24 | SectopRAT malware masqueraded as Notion installer in a recent distribution campaign | A new campaign spreading SectopRAT malware has been identified in the wild. The campaign disguises the malware binaries as installer files for known productivity software called Notion. The fake installers are distributed from malicious websites also masquerading as Notion software download portals. | ALERTS | VIRUS |
24.9.24 | Android Malware: Necro Trojan | The latest version of the Necro Trojan has infected various popular applications, including game mods available on Google Play, affecting over 11 million Android devices. This version employs obfuscation to evade detection and uses steganography to conceal its payloads. | ALERTS | VIRUS |
24.9.24 | Earth Baxia: Targeting Asia-Pacific region by exploiting GeoServer vulnerability | According to a recent report from Trend Micro, the threat actor known as Earth Baxia has been targeting government, telecommunications, and energy organizations in the Asia-Pacific region through spear-phishing emails and the exploitation of the GeoServer vulnerability CVE-2024-36401. | ALERTS | CAMPAIGN |
24.9.24 | SambaSpy malware targeting Italian users | SambaSpy RAT has been distributed in a new malicious campaign targeting users from Italy. The campaign has several stages within it's infection chain and is leveraging either malware downloaders or droppers depending on the observed run. | ALERTS | VIRUS |
24.9.24 | Go Injector Campaign Deploys Lumma Stealer | Researchers have identified a campaign using Go Injector to deploy Lumma Stealer, a malware designed to steal sensitive information. The attack begins when users visit a harmful website displaying a fake captcha, which tricks them into copying and running a command. This command downloads a zip file containing legitimate-looking files and the Go Injector. The injector then installs Lumma Stealer, which decrypts stolen data and sends it to the attackers. | ALERTS | VIRUS |
24.9.24 | Octo2 | Octo2: European Banks Already Under Attack by New Malware Variant | MALWARE | Android |
24.9.24 | Necro | How the Necro Trojan infiltrated Google Play, again | MALWARE | TROJAN |
23.9.24 | PondRAT | Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors | MALWARE | RAT |
23.9.24 | Earth Baxia | Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC | CAMPAIGN | PHISHING |
22.9.24 | CVE-2024-45694 | (9.8 critical): Stack-based buffer overflow, allowing unauthenticated remote attackers to execute arbitrary code on the device. | VULNEREBILITY | CVE |
22.9.24 | CVE-2024-45695 | (9.8 critical): Another stack-based buffer overflow allowing unauthenticated remote attackers to execute arbitrary code. | VULNEREBILITY | CVE |
22.9.24 | CVE-2024-45696 | (8.8 high): Attackers can forcibly enable the telnet service using hard-coded credentials within the local network. | VULNEREBILITY | CVE |
22.9.24 | CVE-2024-45697 | (9.8 critical): Telnet service is enabled when the WAN port is plugged in, allowing remote access with hard-coded credentials. | VULNEREBILITY | CVE |
22.9.24 | CVE-2024-45698 | (8.8 high): Improper input validation in the telnet service allows remote attackers to log in and execute OS commands with hard-coded credentials. | VULNEREBILITY | CVE |
22.9.24 | A stack-based overflow vulnerability exists in the Microchip Advanced Software Framework (ASF) implementation of the tinydhcp server | A stack-based overflow vulnerability exists in the tinydhcp server in the Microchip Advanced Software Framework (ASF) that can lead to remote code execution. | ALERT | ALERT |
22.9.24 | CVE-2024-8105 | A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised. | VULNEREBILITY | CVE |
22.9.24 | CVE-2024-43461 | Windows MSHTML Platform Spoofing Vulnerability | VULNEREBILITY | CVE |
22.9.24 | Marko Polo | “Marko Polo” Navigates Uncharted Waters With Infostealer Empire | GROUP | GROUP |
21.9.24 | TWELVE | -=TWELVE=- is back | GROUP | GROUP |
20.9.24 | 2024-09-17 - Snake KeyLogger (VIP Recovery), FTP exfil | Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. | MALWARE TRAFFIC | MALWARE TRAFFIC |
20.9.24 | 2024-09-16 - Snake KeyLogger (VIP Recovery), SMTP exfil | Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. | MALWARE TRAFFIC | MALWARE TRAFFIC |
20.9.24 | North Korean APT group Appleworm delivers PondRAT via poisoned Python packages | An ongoing campaign involving poisoned Python packages delivering backdoors for Linux and macOS, dubbed PondRAT, has been reported. This campaign is believed to be driven by the North Korean APT group Appleworm (also known as AppleJeus, Citrine Sleet, Gleaming Pisces). | ALERTS | APT |
20.9.24 | New campaign targets GitHub users with Lumma Stealer malware via phishing emails | CERT-AGID has reported a new campaign delivering Lumma Stealer malware. As part of this campaign, GitHub users are receiving alarming emails titled “IMPORTANT! Security Vulnerability Detected in Your Repository (Issue #1),” claiming to be from the “GitHub Security Team.” These emails warn recipients of a fabricated security vulnerability and encourage them to click on a suspicious link. | ALERTS | CAMPAIGN |
20.9.24 | UNC1860 | UNC1860 and the Temple of Oats: Iran’s Hidden Hand in Middle Eastern Networks | APT | APT |
20.9.24 | Cracks in the Foundation | Cracks in the Foundation: Intrusions of FOUNDATION Accounting Software | HACKING | Vulnerebility |
20.9.24 | CVE-2024-8963 | Security Advisory Ivanti CSA 4.6 (Cloud Services Appliance) (CVE-2024-8963) | VULNEREBILITY | CVE |
19.9.24 | Vanilla Tempest | Highway Blobbery: Data Theft using Azure Storage Explorer | CAMPAIGN | Ransomware |
19.9.24 | Storm clouds | Storm clouds on the horizon: Resurgence of TeamTNT? | CAMPAIGN | CAMPAIGN |
19.9.24 | CVE-2024-45409 | The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. | VULNEREBILITY | CVE |
19.9.24 | Raptor Train | Derailing the Raptor Train | BOTNET | BOTNET |
19.9.24 | SambaSpy | Exotic SambaSpy is now dancing with Italian users | MALWARE | RAT |
18.9.24 | New variant of the Gomorrah Stealer identified in the wild | A new variant of the infostealing malware known as Gomorrah Stealer has been identified in the wild. Gomorrah is being offered for sale in form of a Malware-as-a-Service (MaaS) model. The malware is also actively developed by its creators who already announced upcoming 5.5 version of this infostealer to be released soon. | ALERTS | VIRUS |
18.9.24 | MISTPEN | An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader | MALWARE | Backdoor |
18.9.24 | CVE-2024-38812 | VMSA-2024-0019:VMware vCenter Server updates address heap-overflow and privilege escalation vulnerabilities (CVE-2024-38812, CVE-2024-38813) | VULNEREBILITY | CVE |
17.9.24 | Fireant (APT31) unveils new tools in recent campaign against Asia-Pacific government entities | The China-linked threat actor known as Fireant (also referred to as Mustang Panda or APT31) has recently been observed using new tools, including PUBLOAD, FDMTP, and PTSOCKET, in espionage attacks targeting government entities in the Asia-Pacific region. | APT | |
17.9.24 | Ajina mobile banking trojan | Ajina is a recently identified mobile banking trojan variant heavily targeting the Central Asia region. The malware focuses on theft of confidential user data including banking details as well as attempts to intercept the 2FA information. | VIRUS | |
17.9.24 | Stealthy malware targets US-Taiwan Defense Industry conference attendees | A malware campaign targeting entities linked to the upcoming US-Taiwan Defense Industry Conference has been reported. Victims are lured with documents containing a ZIP archive and an LNK file disguised as a legitimate PDF registration form. | VIRUS | |
17.9.24 | CloudImposer | CloudImposer: Executing Code on Millions of Google Servers with a Single Malicious Package | VULNEREBILITY | CVE |
17.9.24 | Phishing Pages Delivered Through Refresh HTTP Response Header | Phishing Pages Delivered Through Refresh HTTP Response Header | HACKING | PHISHING |
17.9.24 | RustDoor | North Korean Hackers Target Cryptocurrency Users on LinkedIn with RustDoor Malware | MALWARE | CRYPTOCURRENCY |
17.9.24 | Protect Your Crypto | Protect Your Crypto: Understanding the Ongoing Global Malware Attacks and What We Are Doing to Stop Them | CRYPTOCURRENCY | CRYPTOCURRENCY |
17.9.24 | CVE-2024-28991 | SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-28991) | VULNEREBILITY | CVE |
15.9.24 | 2024-09-12 - Approximately 11 days of server scans and probes | Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. | MALWARE TRAFFIC | MALWARE TRAFFIC |
15.9.24 | 2024-09-11 - Data Dump: Remcos RAT and XLoader (Formbook) | Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. | MALWARE TRAFFIC | MALWARE TRAFFIC |
14.9.24 | About the security content of visionOS 1.3 | This document describes the security content of visionOS 1.3. | VULNEREBILITY | CVE |
14.9.24 | TrickMo | A new TrickMo saga: from Banking Trojan to Victim's Data Leak | MALWARE | Banking |
14.9.24 | CVE-2024-6671 | In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. | VULNEREBILITY | CVE |
14.9.24 | CVE-2024-6670 | In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. | VULNEREBILITY | CVE |
14.9.24 | Hadooken | Hadooken Malware Targets Weblogic Applications | MALWARE | Linux |
13.9.24 | Mekotio and Mispadu malware distributed during Gecko Assault campaign | A new malicious campaign dubbed Gecko Assault has been reported by the researchers from SCILabs. The threat actors have been distributing two different payloads belonging to the URSA/Mispadu and the Mekotio malware families. | VIRUS | |
13.9.24 | AutoIt-based credential flusher leveraged alongside StealC infostealer | A new campaign delivering the StealC infostealer malware has been observed in the wild. The initial stages of the attack use Amadey malware for loading the infostealer onto the targeted endpoints. In conjunction to the delivered StealC payload, the attackers are leveraging an AutoIt-based credential flusher malware. | VIRUS | |
13.9.24 | Hadooken - Linux malware targeting Weblogic servers | Hadooken is a new Linux malware variant targeting Oracle Weblogic servers. In the initial attack stages the threat actors exploit known vulnerabilities, server misconfigurations or use weak or otherwise compromised credentials to get access to the targeted environments. Upon execution on the vulnerable server instances Hadooken drops two distinct payloads - Tsunami malware and another binary used for mining cryptocurrency. | VIRUS | |
13.9.24 | ShrinkLocker Ransomware: Leveraging BitLocker for encryption and system disruption | ShrinkLocker is a recently discovered ransomware that exploits BitLocker, a legitimate Windows feature, to encrypt data and lock users out of their systems. Unlike traditional ransomware, ShrinkLocker uses BitLocker's secure boot partition to make decryption extremely difficult. | RANSOM | |
13.9.24 | New Phishing Campaign Exploiting CapCut | CapCut, a popular video editor, is being exploited in phishing attacks. The latest campaign involves a malicious package that includes a legitimate CapCut app, JamPlus build utility, and a harmful ".lua" script. Running the app triggers JamPlus to execute the script, which then downloads and runs a final payload from a remote server. | PHISHING | |
13.9.24 | Veaty and Spearal: Emerging malware in recent campaign against Iraqi Government | A new malware family, Veaty and Spearal, has been reported by Check Point, a CTA member, as being used in a campaign targeting Iraqi government infrastructure. The malware employs several techniques, including a passive IIS backdoor, DNS tunneling, and command-and-control (C2) communication through compromised email accounts. | VIRUS | |
13.9.24 | Ajina.Banker | Ajina attacks Central Asia: Story of an Uzbek Android Pandemic | MALWARE | Banking |
13.9.24 | Void captures over a million Android TV boxes | MALWARE | TV | |
13.9.24 | Proxyjacking | From Automation to Exploitation: The Growing Misuse of Selenium Grid for Cryptomining and Proxyjacking | CAMPAIGN | CRYPTOCURRENCY |
13.9.24 | Spearal | Targeted Iranian Attacks Against Iraqi Government Infrastructure | MALWARE | ISS Backdoor |
13.9.24 | Veaty | Targeted Iranian Attacks Against Iraqi Government Infrastructure | MALWARE | ISS Backdoor |
13.9.24 | OilRig | Targeted Iranian Attacks Against Iraqi Government Infrastructure | APT | APT |
13.9.24 | Quad7 | A glimpse into the Quad7 operators’ next moves and associated botnets | BOTNET | BOTNET |
13.9.24 | DragonRank | DragonRank, a Chinese-speaking SEO manipulator service provider | GROUP | GROUP |
13.9.24 | Yet Another Silly Stealer (YASS) Infostealer | A new infostealer, being referred to as 'Yet Another Silly Stealer' (YASS), has been observed. While it shares some features with CryptBot, YASS also has distinct characteristics. The research compares YASS to CryptBot, emphasizing YASS's unique code and its delivery via a multi-stage downloader called MustardSandwich. This downloader, executed through a Windows LNK file, involves two JScript stages and two PowerShell stages, with the first PowerShell script run via an ActiveXObject. | VIRUS | |
13.9.24 | BLX (aka XLABB) Stealer activity | BLX Stealer known also as XLABB Stealer is a malware variant initially discovered back last year. New activity attributed to this infostealer has been observed in the wild. BLX is an open-source malware actively distributed via Telegram and other platforms. Functionality-wise the malware is capable of stealing confidential data from compromised endpoints. The exfiltration efforts focus on data such as credentials, information stored in browsers, 3rd party applications accounts, Discord tokens, cryptocurrency wallets and others. | VIRUS | |
13.9.24 | SEO manipulation leveraged for PlugX and BadIIS malware delivery | A new malicious campaign attributed to the DragonRank threat group has been discovered by researchers from Cisco Talos. The attackers have been reported to leverage search engine optimization (SEO) manipulation techniques to deploy malicious webshells, collect information off the infected systems as well as to deliver PlugX and BadIIS malware payloads. | VIRUS | |
13.9.24 | Ransomware activity surge observed in second quarter of 2024 | Ransomware activity increased markedly in the second quarter of 2024 as attackers seemingly recovered their momentum following the disruption experienced in late 2023 and early 2024. Analysis of data from ransomware leak sites found that ransomware actors claimed 1,310 attacks in the second quarter of 2024, a 36% increase on the first quarter of this year. This was the second highest amount of attacks claimed in a quarter by ransomware operators, short of the record 1,488 attacks claimed in the third quarter of 2023. | RANSOM | |
13.9.24 | Linux SSH servers targeted by new SuperShell malware variant | SuperShell malware variant has been observed in a recent campaign targeted at vulnerable or otherwise misconfigured Linux SSH servers. The malware is Go-based and has the functionality to act as a reverse shell effectively allowing the attackers remote control and remote code execution on the infected machine. The servers compromised with use of SuperShell malware are likely to be used later by the attackers for the purpose of cryptomining or DDoS attacks. | VIRUS | |
13.9.24 | ScRansom Ransomware | Researchers have found that the CosmicBeetle group is now using a new ransomware dubbed ScRansom, replacing their old Scarab ransomware. They are targeting small and medium businesses worldwide and are copying LockBit's style in their ransom notes and websites. CosmicBeetle is suspected to be affiliated with RansomHub, a recently active ransomware gang that has been increasing its operations since March 2024. | ||
13.9.24 | VSCode abused by Chinese APT group | Stately Taurus, a Chinese APT group that carries out cyber-espionage attacks, has abused Visual Studio Code software in espionage operations targeting government entities in Southeast Asia. This threat actor used VSCode’s embedded reverse shell feature to gain a foothold in target networks to execute arbitrary code and deliver additional payloads. The leveraged this mechanism to deliver malware, perform reconnaissance, and exfiltrate sensitive data. | APT | |
13.9.24 | New variant of Cicada3301 ransomware found in the wild | According to a recent report from Palo Alto, Repellent Scorpius is a new ransomware-as-a-service (RaaS) group responsible for the delivery of a ransomware variant dubbed Cicada3301. The threat actors have been observed to leverage a variety of Living-Off-the-Land (LOTL) tools in their attacks. Among them PsExec for ransomware execution and Rclone tool used for data exfiltration. | RANSOM | |
13.9.24 | Mekotio and BBTok malware remain active among the banking trojans targeting LATAM | Mekotio and BBTok malware variants remain active among the banking trojan families distributed lately across the Latin America region. The malware is usually spread via phishing campaigns utilizing business- or judicial-themed lures. The spam emails leverage either links leading to malicious archive downloads or use malicious attachments directly within the spam emails. While Mekotio is an older malware variant, BBTok was initially discovered just in 2020. Both variants target similar geographical locations and attempt to exfiltrate credentials and sensitive information in order to carry out unauthorized banking operations. | VIRUS | |
13.9.24 | Threat actors spoof An Post Ireland services to steal credentials | Symantec has identified a new wave of phishing attacks that impersonate An Post Ireland services to steal credentials. An Post Ireland is a state owned postal service provider in Ireland. In this campaign, phishing emails are disguised as parcel notifications to reschedule deliveries or check parcel details. The email content is brief, encouraging recipients to click on a phishing URL. Once clicked, victims encounter webpages designed for credential harvesting. | CRIME | |
13.9.24 | SpyAgent: Mobile malware stealing cryptocurrency wallets through image scanning | A new mobile malware called SpyAgent has been identified targeting mnemonic keys by scanning for images on your device that might contain them. A mnemonic key is a 12-word phrase used to recover cryptocurrency wallets. These secret phrases are highly valuable to threat actors because gaining access to them enables them to restore your wallet on their own devices and steal all the funds stored within. | VIRUS | |
13.9.24 | Emerging Loki Backdoor variant employs Mythic Framework and Havoc Techniques | A new version of the Loki backdoor has been discovered targeting Russian organizations. This variant is compatible with the Mythic framework and utilizes various techniques from the Havoc framework, which complicates analysis. The updated variant is divided into a loader and a DLL. The loader gathers system information from the compromised machine, uploads it to the attacker’s C2 server, and retrieves the DLL in response. The DLL is then loaded into memory to download additional payloads and carry out further attacks. | VIRUS | |
11.9.24 | Latrodectus campaign impersonates Antivirus software to deploy remote payloads | A campaign deploying Latrodectus malware, disguised as a legitimate antivirus vendor, has been reported. The initial attack vector involves phishing and malicious ads. Latrodectus functions as a backdoor, allowing the execution of remote commands and the deployment of malicious payloads such as Brute Ratel C4. It employs common techniques for persistence, including the use of the Windows Component Object Model (COM) and employs TLS certificates for communication with its command-and-control (C2) server. | CAMPAIGN | |
11.9.24 | CVE-2024-45195: Remote Code Execution (RCE) vulnerability in Apache OFBiz | CVE-2024-45195 is a high-severity (CVSS: 7.5) Remote Code Execution (RCE) vulnerability in Apache OFBiz, a comprehensive suite of business applications. An attacker could likely exploit this vulnerability by framing a specially designed URL that bypasses authentication protocols. If successfully exploited, this vulnerability will allow remote attackers to execute malicious code on the server, potentially leading to complete system compromise. | VULNEREBILITY | |
11.9.24 | Ongoing exploitation of CVE-2024-36401 in OSGeo GeoServer GeoTools | Multiple campaigns are exploiting a recently disclosed security flaw in OSGeo GeoServer GeoTools. The vulnerability, identified as CVE-2024-36401 (with a CVSS score of 9.8), is a critical remote code execution bug that allows malicious actors to take control of affected instances. This flaw has been leveraged to deploy GOREVERSE, a reverse proxy server designed to connect with a command-and-control (C2) server for post-exploitation activities. | VULNEREBILITY | |
11.9.24 | TIDRONE activities in Taiwan | In recent news, the TIDRONE group has been targeting Taiwan's military and satellite industries, focusing on drone manufacturers. Using malicious tools like CXCLNT and CLNTEND, the group enables data theft, credential dumping, and user control bypass. According to reports, their Tactics, Techniques, and Procedures (TTPs) include supply chain attacks via ERP software, pointing towards espionage motives. | GROUP | |
11.9.24 | Babylon open-source RAT targets Malaysia | Babylon RAT is an open-source malware variant recently distributed to users in Malaysia. The attack chain involves usage of crafted .iso files mimicking PDF documents. The delivered ISO archive contains a hidden PowerShell script, a decoy PDF document and a malicious executable leading to infection with the Babylon RAT. | VIRUS | |
11.9.24 | Babylon open-source RAT targets Malaysia | Babylon RAT is an open-source malware variant recently distributed to users in Malaysia. The attack chain involves usage of crafted .iso files mimicking PDF documents. The delivered ISO archive contains a hidden PowerShell script, a decoy PDF document and a malicious executable leading to infection with the Babylon RAT. | VIRUS | |
11.9.24 | ToneShell Backdoor Targets IISS Summit | A cyber espionage campaign involving the ToneShell backdoor, attributed to Mustang Panda, has been reported targeting attendees of the 2024 IISS Defense Summit in Prague. The attack leverages a malicious PIF file disguised as summit documents to gain access to sensitive defense discussions. The malware achieves persistence via registry run keys and scheduled tasks and communicates with a C2 server in Hong Kong using raw TCP that mimics TLS. | VIRUS | |
11.9.24 | BlindEagle strikes Colombia's Insurance sector with Quasar RAT variant | BlindEagle, an advanced persistent threat actor, has been observed targeting Colombia’s insurance sector with the BlotchyQuasar Remote Access Trojan (RAT). The attack chain begins with phishing emails impersonating the Colombian tax authority, containing links to malware hosted on compromised Google Drive accounts. | VIRUS | |
11.9.24 | Crimson Palace | Crimson Palace returns: New Tools, Tactics, and Targets | CAMPAIGN | APT |
11.9.24 | Earth Preta | Earth Preta Evolves its Attacks with New Malware and Strategies | CAMPAIGN | APT |
11.9.24 | CVE-2024-38014 | (CVSS score: 7.8) - Windows Installer Elevation of Privilege Vulnerability | VULNEREBILITY | CVE |
11.9.24 | CVE-2024-38217 | (CVSS score: 5.4) - Windows Mark-of-the-Web (MotW) Security Feature Bypass Vulnerability | VULNEREBILITY | CVE |
11.9.24 | CVE-2024-38226 | (CVSS score: 7.3) - Microsoft Publisher Security Feature Bypass Vulnerability | VULNEREBILITY | CVE |
11.9.24 | CVE-2024-43491 | (CVSS score: 9.8) - Microsoft Windows Update Remote Code Execution Vulnerability | VULNEREBILITY | CVE |
11.9.24 | CVE-2024-29847 | (CVSS score: 10.0) - A deserialization of untrusted data vulnerability that allows a remote unauthenticated attacker to achieve code execution. | VULNEREBILITY | CVE |
11.9.24 | CosmicBeetle | CosmicBeetle steps up: Probation period at RansomHub | GROUP | RANSOMWARE |
11.9.24 | PIXHELL | PIXHELL Attack: Leaking Sensitive Information from Air-Gap Computers via ‘Singing Pixels?/P> | ATTACK | ATTACK |
11.9.24 | RAMBO | RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM | ATTACK | ATTACK |
9.9.24 | BlindEagle | BlindEagle Targets Colombian Insurance Sector with BlotchyQuasar | APT | APT |
9.9.24 | Mustang Panda | Chinese APT Abuses VSCode to Target Government in Asia | APT | APT |
9.9.24 | WhisperGate | WhisperGate is a multi-stage wiper designed to look like ransomware that has been used against multiple government, non-profit, and information technology organizations in Ukraine since at least January 2022. | MALWARE | Wrapper |
9.9.24 | RAMBO | RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM | ATTACK | ATTACK |
9.9.24 | EUCLEAK | Side-Channel Attack on the YubiKey 5 Seri | ATTACK | ATTACK |
9.9.24 | CVE-2024-32896 | there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | VULNEREBILITY | CVE |
9.9.24 | CVE-2024-42057 | A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through | VULNEREBILITY | CVE |
9.9.24 | CVE-2024-7261 | The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) | VULNEREBILITY | CVE |
9.9.24 | CVE-2024-7591 | Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above | VULNEREBILITY | CVE |
9.9.24 | Android SpyAgent | New Android SpyAgent Campaign Steals Crypto Credentials via Image Recognition | MALWARE | Android |
9.9.24 | Loki | Loki: a new private agent for the popular Mythic framework | MALWARE | Backdoor |
9.9.24 | Unit 29155 | Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure | GROUP | Military group |
9.9.24 | TIDRONE | TIDRONE Targets Military and Satellite Industries in Taiwan | MALWARE | Military Malware |
8.9.24 | CVE-2024-41622 | Remote Command Execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1/ interface. (CVSS v3 score: 9.8 "critical") | VULNEREBILITY | CVE |
8.9.24 | CVE-2024-44340 | RCE vulnerability via the smartqos_express_devices and smartqos_normal_devices parameters in SetSmartQoSSettings (authenticated access requirement reduces the CVSS v3 score to 8.8 "high"). | VULNEREBILITY | CVE |
8.9.24 | CVE-2024-44341 | RCE vulnerability via the lan(0)_dhcps_staticlist parameter, exploitable through a crafted POST request. (CVSS v3 score: 9.8 "critical") | VULNEREBILITY | CVE |
8.9.24 | CVE-2024-44342 | RCE vulnerability via the wl(0).(0)_ssid parameter. (CVSS v3 score: 9.8 "critical") | VULNEREBILITY | CVE |
8.9.24 | Cicada3301 | Dissecting the Cicada | RANSOMWARE | RANSOMWARE |
8.9.24 | COVERTCATCH | North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Scams | MALWARE | Python |
8.9.24 | CVE-2024-40766 | SonicOS Improper Access Control Vulnerability | VULNEREBILITY | CVE |
8.9.24 | CVE-2024-36401 | Threat Actors Exploit GeoServer Vulnerability CVE-2024-36401 | EXPLOIT | EXPLOIT |
7.9.24 | CVE-2024-44000 | Critical Account Takeover Vulnerability Patched in LiteSpeed Cache Plugin | VULNEREBILITY | CVE |
7.9.24 | CVE-2024-45195 | Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue. | VULNEREBILITY | CVE |
7.9.24 | Tropic Trooper | Tropic Trooper spies on government entities in the Middle East | APT | |
7.9.24 | Veeam Security Bulletin (September 2024) | All vulnerabilities disclosed in this section were discovered during internal testing (unless otherwise indicated) and affect Veeam Backup & Replication 12.1.2.172 and all earlier version 12 builds. | VULNEREBILITY | CVE |
6.9.24 | Tropic Trooper unleashes new China Chopper variant and Crowdoor loader | Tropic Trooper, a Chinese-speaking APT group, has been reported targeting Middle Eastern government entities in a cyber espionage campaign. The attackers focused on systems related to human rights studies, using a new China Chopper variant deployed on a compromised Umbraco CMS server. The group employed DLL hijacking to load malicious payloads, including Crowdoor, a loader linked to the SparrowDoor backdoor. | APT | |
6.9.24 | Spammers abusing uncommon TLDs | Symantec has recently observed a new phishing campaign being delivered from recently created domains designed to steal credentials and/or banking information. In this campaign we have observed over 200 newly registered domains, most of these domains are registered with uncommon TLDs such as '.best', '.rest' or '.shop'. The subjects and message content attempt to lure recipients in with promises of dubious health products. | SPAM | |
6.9.24 | Formbook Targets Global Sectors with Fake RFQ from Chemical-Oil Joint Venture | Symantec has recently observed a Formbook actor impersonating a major joint venture between a global chemical company based in Germany and a national oil and gas company from Malaysia. In this malicious email campaign, they're targeting companies across multiple countries and various industry sectors, including: | VIRUS | |
6.9.24 | Acab Infostealer | Acab is a Python-based infostealing malware variant recently observed in the wild. The malware shows some code similarities to another variant known as 1312 Stealer. Acab has the functionality to extract various confidential information from infected endpoints including credentials, banking information, crypto-wallet data, application data/tokens, various information stored in web browsers and others. | VIRUS | |
6.9.24 | CVE-2024-5932 - GiveWP WordPress Plugin vulnerability | CVE-2024-5932 is a recently disclosed vulnerability affecting GiveWP plugin, which is a Donation and Fundraising Platform plugin for WordPress. The flaw allows for malicious injection within the vulnerable version of the plugin, up to 3.14.1. Successfully exploitation of this flaw might allow unauthenticated attackers to inject an arbitrary PHP Object which can further lead up to arbitrary code execution within the context of the vulnerable application. A patched version 3.14.2 of the plugin has been already released. | VULNEREBILITY | |
6.9.24 | MacroPack generated payloads distributed in latest campaigns | A payload generation framework called MacroPack has been leveraged to create miscellaneous payloads in a series of malicious activities recently observed by the researchers from Cisco Talos. The attackers have been using Word, Excel or PowerPoint lures that once opened run malicious MacroPack VBA code that ultimately leads to the final payload delivery and execution. Among the distributed payloads were Brute Ratel and Havoc post-exploitation tools as well as a new variant of the PhantomCore RAT. | CAMPAIGN | |
6.9.24 | KTLVdoor backdoor leveraged by the Funnelweb APT | A new Golang-based backdoor dubbed KTLVdoor has been discovered by researchers from Trend Micro. The malware has been attributed to the Funnelweb APT (also known as Earth Lusca). KTLVdoor is a highly obfuscated malware that comes in variants supporting both Windows and Linux platforms. Functionality-wise the malware is capable of running commands and shellcode received from the C2 servers, various file and directory operations on the infected machine including file download/upload, among others. | VIRUS | |
6.9.24 | SLOW#TEMPEST campaign targets Chinese entities | A recently identified malware campaign named SLOW#TEMPEST was uncovered targeting Chinese entities. The attack chain starts by way of malspam attachments in the form of zip files which are bundled with a shortcut lnk file in addition to dll/exe files. Successful execution of the available content leads to the establishment of a foothold in the targeted environment. Through this position, the attackers can execute further TTPs to accomplish their goals (such as credential harvesting, lateral movement, persistence and privilege escalation). | CAMPAIGN | |
6.9.24 | Latrodectus 1.4: New version unveiled with advanced capabilities | A newer version of the Latrodectus downloader has been observed, featuring enhancements like a new string deobfuscation method, a revised C2 endpoint, and two additional backdoor commands. The infection chain begins with a heavily obfuscated JavaScript file, which uses numerous comments to inflate file size and complexity, complicating analysis. The malware then extracts and executes hidden code, subsequently downloading and installing an MSI file from a remote server. This MSI file loads an obfuscated DLL to perform its malicious tasks. | VIRUS | |
5.9.24 | Emansrepo infostealer | Researchers from Fortinet reported on a new Python-based infostealer variant dubbed Emansrepo. This malware has been distributed via phishing campaigns masquerading the malicious emails as purchase invoices or orders. The initial attack chain stage varies depending on the campaign and may leverage different attachments such as .html or .7z. The dropped Emansrepo payload has the functionality to collect miscellaneous confidential data from the compromised endpoints including credentials, banking information, crypto-wallets, browser and download history, autofill data as well as exfiltrate text/document files from various on-disk locations. | VIRUS | |
5.9.24 | Zharkbot malware | Zharkbot is a C++based malware loader variant being dropped by Amadey trojan in some recently observed campaigns. Zharkbot employs various anti-analysis, anti-VM and sandbox detection/evasion techniques. Once on the compromised machine, the malware will attempt to set up persistence by copying itself to the temp folder and setting up a scheduled task execution. Zharkbot has the functionality to download and execute arbitrary payloads on the infected endpoints. | VIRUS | |
5.9.24 | CVE-2024-24809 & CVE-2024-31214 vulnerabilities affecting Traccar 5 | CVE-2024-24809 and CVE-2024-31214 are recently disclosed vulnerabilities affecting Traccar 5 which is an open-source GPS tracking system. The vulnerabilities are rated as CVSS score: 8.5 and CVSS score: 9.7 respectively. Successful exploitation in the affected product versions 5.1 through 5.12 could provide unauthenticated attackers with path traversal and unrestricted upload of arbitrary files. This exploitation could potentially lead to further compromise such as remote code execution on the affected instances. Product vendor has already released patch addressing the vulnerabilities in product version 6.0. | VULNEREBILITY | |
5.9.24 | CVE-2024-22319 - JNDI Injection Vulnerability in IBM Operational Decision Manager | CVE-2024-22319 is a critical (CVSS: 9.8) JNDI injection vulnerability in IBM Operational Decision Manager. IBM ODM is a comprehensive decision automation solution that helps organizations automate and optimize their decision-making processes. Attackers can exploit this flaw by injecting malicious code into an unchecked argument passed to a specific API through JNDI (Java Naming and Directory Interface). | VULNEREBILITY | |
5.9.24 | Stone Wolf campaign targets Russian firms with Meduza Stealer malware | A malicious campaign by the Stone Wolf threat actor targeting Russian firms has been reported. The attackers use phishing emails impersonating a legitimate industrial automation provider to deliver the Meduza Stealer malware. The attack vector involves an archive containing a legitimate document alongside a malicious link to download and execute the Stealer payload. This malware collects and exfiltrates credentials, system information, and application data from compromised systems. | CAMPAIGN | |
5.9.24 | WailingCrab: A WikiLoader variant exploiting VPN Spoofs | A recent report from Palo Alto reveals that WailingCrab, a variant of WikiLoader, is being distributed through SEO poisoning and spoofed GlobalProtect VPN software. This campaign primarily targets the U.S. higher education and transportation sectors. The attack vector involves multiple stages like DLL sideloading, shellcode injection, and using MQTT for command and control. Attackers employ various evasion techniques such as fake error messages, process checks, and encryption. The loader's advanced tactics also leverage compromised WordPress sites and cloud-based Git repositories for infrastructure. | VIRUS | |
5.9.24 | Luxy Infostealer | Luxy is a recently discovered malware variant with both infostealing and ransomware capabilities. Luxy collects various confidential information from the compromised machines including credentials, browser data, cookies, cryptocurrency wallets, etc. The ransomware module is used to encrypt files on the infected endpoint using AES256 algorithm. The ransom note dropped after the completed encryption asks the victims for ransom payment and for them to contact the attackers via Discord. | VIRUS | |
5.9.24 | Cybercriminals Target Malaysia’s Digital Lifestyle with SpyNote | Around the world, E-commerce (shopping), service-oriented (food delivery, ride-hailing, and on-demand services), digital payment and deal aggregator android applications are highly popular. They have become integral to the digital lifestyle, meeting the growing demand for convenient, cost-effective services across various markets. These apps cater to consumers' needs for efficiency, accessibility, and savings, making them essential tools in everyday life. | VIRUS | |
5.9.24 | CVE-2024-7593 - Ivanti Virtual Traffic Manager (vTM) Authentication Bypass vulnerability | CVE-2024-7593 is a critical (CVSS score 9.8) XML authentication bypass vulnerability affecting Ivanti Virtual Traffic Manager (vTM). Successful exploitation of this flaw could allow the attackers to bypass authentication and create new administrative users. Such compromise could potentially lead later to arbitrary code execution within the context of the vulnerable application. Product vendor has already released patch addressing this vulnerability in the updated software versions. | VULNEREBILITY | |
5.9.24 | RAZR Ransomware | RAZR is a recently identified ransomware variant that abuses web hosting service called PythonAnywhere for hosting the malicious binaries. The malware uses AES-256 algorithm for encryption and appends .raz extension to the filenames. The ransom note is dropped in form of a text file README.txt in which the attackers also threaten that the confidential files have not only been encrypted but also exfiltrated. | RANSOM | |
5.9.24 | Macropack | Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads | HACKING | Malware |
5.9.24 | KTLVdoor | Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion | MALWARE | Backdoor |
5.9.24 | CVE-2024-20439 | (CVSS score: 9.8) - The presence of an undocumented static user credential for an administrative account that an attacker could exploit to log in to an affected system | VULNEREBILITY | CVE |
5.9.24 | CVE-2024-20440 | (CVSS score: 9.8) - A vulnerability arising due to an excessively verbose debug log file that an attacker could exploit to access such files by means of a crafted HTTP request and obtain credentials that can be used to access the API | VULNEREBILITY | CVE |
5.9.24 | APT Lazarus | APT Lazarus: Eager Crypto Beavers, Video calls and Games | APT | APT |
5.9.24 | RansomHub Ransomware | #StopRansomware: RansomHub Ransomwa | RANSOMWARE | RANSOMWARE |
5.9.24 | CVE-2024-7261 | The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and earlier, WAX655E firmware version 7.00(ACDO.1) and earlier, WBE530 firmware version 7.00(ACLE.1) and earlier, and USG LITE 60AX firmware version V2.00(ACIP.2) could allow an unauthenticated attacker to execute OS commands by sending a crafted cookie to a vulnerable device. | VULNEREBILITY | CVE |
5.9.24 | Revival Hijack | Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk | HACKING | HACKING |
5.9.24 | CVE-2024-32896 | there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | VULNEREBILITY | CVE |
5.9.24 | WikiLoader | Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant | MALWARE | Loader |
5.9.24 | Head Mare | Head Mare: adventures of a unicorn in Russia and Belarus | GROUP | GROUP |
5.9.24 | Cicada3301 | Decoding the Puzzle: Cicada3301 Ransomware Threat Analysis | RANSOMWARE | RANSOMWARE |
5.9.24 | Rocinante | Rocinante: The trojan horse that wanted to fly | MALWARE | Trojan |